Amelie Lacroix

System Hacking ( pwnable )/CTF Write-up 검색 결과

해당 글 26건

[ASIS CTF] asvdb ( write-up )

ASIS CTF asvdb ( write - up )Contenttcache duplogic error Analysisstruct bug { _DWORD year; _DWORD id; _QWORD *title; _QWORD *desc; _DWORD severity; };위와 같은 구조체를 사용한다. create()int create() { void *title; // ST20_8 void *buf; // ST28_8 unsigned int bug_index; // [rsp+4h] [rbp-2Ch] unsigned int size; // [rsp+10h] [rbp-20h] bug *bug; // [rsp+18h] [rbp-18h] ​ bug_index = find_buglist(); if ( bug_ind..

System Hacking ( pwnable )/CTF Write-up 2019. 12. 8. 17:29

[ASIS CTF] FCascasde ( write-up )

ASIS CTF FCascasde ( write - up )ContentLog Error ( arbitrary address off by one )_IO_buf_base Exploit Analysisvoid __fastcall __noreturn interaction(void *buf) { while ( 1 ) { write(1, "> ", 2uLL); read(0, buf, 0x128uLL); if ( strncmp(buf, "11010110", 8uLL) || chk ) { if ( !strncmp(buf, "10110101", 8uLL) ) ccloud(); } else { chk = 1; leak(buf); } } }아래와 같이 몇가지 기능을 하는 프로그램이다.11010110을 입력하면 leak(..

System Hacking ( pwnable )/CTF Write-up 2019. 12. 3. 21:38

[ASIS CTF] TinyPwn ( write-up )

ASIS CTF TinyPwn ( write - up )ContentAsm reversingexecveat Analysis# Start .text:00000000004000B0 xor rax, rax .text:00000000004000B3 xor rbx, rbx .text:00000000004000B6 xor rcx, rcx .text:00000000004000B9 xor rdx, rdx .text:00000000004000BC xor rdi, rdi .text:00000000004000BF xor rsi, rsi .text:00000000004000C2 xor r8, r8 .text:00000000004000C5 xor r9, r9 .text:00000000004000C8 xor r10, r10 .t..

System Hacking ( pwnable )/CTF Write-up 2019. 12. 3. 12:58

[ASIS CTF] cat ( write-up )

ASIS CTF cat ( write - up )ContentUsing After FreeGOT overwrite Analysis__int64 __fastcall main(__int64 a1, char **a2, char **a3) { signed int true; // [rsp+8h] [rbp-28h] char buf; // [rsp+10h] [rbp-20h] unsigned __int64 canary; // [rsp+28h] [rbp-8h] ​ canary = __readfsqword(0x28u); setup(); print_banner(); true = 1; while ( true ) { menu(); printf("which command?\n> "); read(0, &buf, 4uLL); swi..

System Hacking ( pwnable )/CTF Write-up 2019. 12. 3. 09:36

[Rctf] babyheap ( write-up )

Rctf babyheap ( write-up )Analysissetup()unsigned __int64 setup() { unsigned __int16 buf; // [rsp+2h] [rbp-1Eh] int fd; // [rsp+4h] [rbp-1Ch] void *addr; // [rsp+8h] [rbp-18h] void *check; // [rsp+10h] [rbp-10h] unsigned __int64 canary; // [rsp+18h] [rbp-8h] ​ canary = __readfsqword(0x28u); num_of_chunk = 0; setvbuf(stdin, 0LL, 2, 0LL); setvbuf(stdout, 0LL, 2, 0LL); setvbuf(stderr, 0LL, 2, 0LL);..

System Hacking ( pwnable )/CTF Write-up 2019. 11. 4. 12:26

[Layer7 CTF] Angel-in-us ( write-up )

Layer7 CTF - Angel in usSummaryTop chunk freestdout leakscanf trick이문제는 SED팀 소속 Howdays라는 빡고수형이 낸 문제이다.대회중에도 솔버가 한명도 없었던 재밌는 문제이다. Analysismain()void __fastcall __noreturn main(__int64 a1, char **a2, char **a3) { __int16 buf; // [rsp+6h] [rbp-Ah] unsigned __int64 canary; // [rsp+8h] [rbp-8h] ​ canary = __readfsqword(0x28u); setup(); buf = 0; while ( 1 ) { menu(); read(0, &buf, 2uLL); if ( buf ==..

System Hacking ( pwnable )/CTF Write-up 2019. 10. 11. 15:37

[Layer7 CTF] How old are you? ( write-up )

Layer7 CTF - How old are you?Summarysimple trickseccomp syscallopenat()다른 출제자분들이 문제를 너무 빡시게내셔서 나도 빡시게 내야하나 싶었다.근데 그냥 쉬운문제 하나 있어야겠다 싶어서 쉬운거 하나 냈다.원래 getdents함수를 이용해서 플래그 패스를 찾게 하려고 했으나 그냥 쉽게 냈다. Analysismain()int __cdecl main(int argc, const char **argv, const char **envp) { char buf; // [rsp+0h] [rbp-110h] int v5; // [rsp+100h] [rbp-10h] int v6; // [rsp+104h] [rbp-Ch] int v7; // [rsp+108h] [rbp-..

System Hacking ( pwnable )/CTF Write-up 2019. 10. 11. 12:34

[Timisoara CTF] Timisoara CTF Quals ( write-up )

Crypto - solved by team comflexBaby Crypto ( 50 pts )In the name of the problem, I thought it was a Caesar cipher.So I use Caesar decoder site. ( https://cryptii.com/ )Shift by 8 to get the flag.Otil bw amm gwc uilm qb! Emtkwum bw bpm ewvlmznct ewztl wn kzgxbwozixpg! Pmzm qa gwcz zmeizl: BQUKBN{Rctqca_Kimaiz_e0ctl_j3_xzwcl} ​ => Glad to see you made it! Welcome to the wonderful world of cryptogr..

System Hacking ( pwnable )/CTF Write-up 2019. 9. 22. 14:39